TreeView + SiteMap & Security - Not what I expected (big let down)

I've been applying my Sitemap which has security trimming enabled to my treeview. It does very little 'security' at all. I have one role: admins

Problem 1:



Item 1 - no URL - roles="admins"

    Item 2 - Has URL - roles="*"
When Logged in as user in admins group, I see both items. When not logged in, I see no items (as expected). However, I can just type in item 2's URL..

Problem 2:



Item 1 - has url - roles="admins"

    Item 2 - has url - roles ="admins"
When logged in as user in admins group, I see both items. When not logged in, I see both items, and can click both just fine.

The solution is of course to manage the web.config file.. sytem.web \ authorization  section.. but WHY must security be managed in TWO locations.. why couldn't ...